Bank Concurrent & Statutory Audit: The Process, Start to Finish
The mechanics of Bank Concurrent & Statutory Audit are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the Bank Concurrent & Statutory Audit page.
How is concurrent audit different from statutory branch audit?
Concurrent audit is a continuous, internal control-focused review that reports to bank management (branch, zonal, or head office) on a recurring cycle, with no formal audit opinion issued. Statutory branch audit is an annual attest engagement under the Banking Regulation Act 1949, resulting in a signed audit report on the branch's financial statements plus the RBI-prescribed LFAR. The two are complementary — a branch under active concurrent audit coverage typically enters the annual statutory audit with fewer unresolved issues, because irregularities have already been surfaced and addressed during the year.
In practice: We encourage banks to view concurrent and statutory audit as two layers of the same oversight architecture rather than redundant exercises — the value compounds when both functions share findings.
How does a CA firm get appointed for bank concurrent audit?
Appointment is generally made by the bank's zonal, regional, or head office through its own concurrent audit empanelment process — which is typically a separate list from the RBI/ICAI statutory branch audit panel, even at the same bank. Eligible CA firms apply to the bank's concurrent audit panel based on the bank's specific eligibility criteria (often partner strength and prior banking-audit experience), and branches or units are then allotted based on the bank's coverage requirements.
In practice: We advise firms not to assume that RBI/ICAI statutory empanelment automatically qualifies them for a bank's concurrent audit panel — the two lists and their eligibility criteria are usually managed separately, and firms should apply for concurrent audit empanelment specifically.
How often is concurrent audit reporting done?
This is set by the specific bank's concurrent audit manual and the appointment letter — commonly monthly, though some banks specify quarterly reporting for lower-risk units. The underlying testing itself is meant to be near-continuous (close to the transaction date), even where the formal written report is submitted on a monthly or quarterly cycle.
In practice: We confirm the exact reporting cadence and format at engagement acceptance, since it varies meaningfully between banks — treating every bank's concurrent audit the same way is a common and avoidable mismatch.
Does concurrent audit apply to cooperative banks and NBFCs, or only commercial banks?
Concurrent audit requirements extend to cooperative banks operating under a banking licence (subject to RBI directions applicable to banking-licensed cooperatives, read with the relevant State Cooperative Societies Act), in addition to commercial bank branches. NBFCs in the Upper and Middle Layers under RBI's Scale-Based Regulation framework are subject to enhanced internal audit and governance norms, and many such NBFCs adopt a concurrent-audit-style continuous review as internal policy, though this is framed under RBI's internal-audit and governance expectations for NBFCs rather than the same concurrent-audit circulars that apply to banks. The specific coverage criteria and reporting expectations differ by category of regulated entity.
In practice: We confirm the exact regulatory framework applicable to each client — commercial bank, cooperative bank, or NBFC — before finalising the concurrent audit scope, since the governing circulars and reporting formats are not identical across these categories.
Can the same CA firm hold both the concurrent audit and statutory branch audit mandate at one branch?
Yes, subject to the bank's own policy and any independence considerations the bank or RBI framework may apply. Where permitted, holding both mandates allows genuine continuity — concurrent audit findings through the year inform the statutory auditor's risk assessment at year-end, and the statutory audit's LFAR benefits from a fuller picture of the branch's control environment across the year rather than a single point-in-time sample.
In practice: We confirm with each bank whether dual appointment is permitted under its specific policy before proposing this arrangement — some banks prefer separation between the two functions as a matter of internal governance, and we respect that where specified.
How does PNPC ensure independence in a continuous, on-site engagement like concurrent audit?
We conduct a conflict check against the branch's major borrower and account relationships at engagement acceptance, and reassess periodically given the continuous nature of the engagement. Where PNPC has an existing advisory, tax, or audit relationship with a party whose transactions would be reviewed under concurrent audit, we assess and, where appropriate, disclose or decline the relevant portion of the engagement, consistent with ICAI's Code of Ethics.
In practice: Independence risk in a continuous, on-site engagement is different in character from an annual sample-based audit — we treat conflict checks as an ongoing discipline for concurrent audit mandates, not a one-time exercise at engagement start.
Can a bank change or expand concurrent audit coverage mid-year?
Yes. Banks periodically review coverage based on changing risk profile, business volume growth at a branch, or specific regulatory or internal audit concerns, and can expand (or occasionally reduce) concurrent audit coverage accordingly, subject to the bank's own internal approval process and any RBI-linked minimum coverage requirement.
In practice: We stay in regular contact with the bank's zonal or head office concurrent audit coordinator specifically to be positioned for expanded scope requests, rather than learning of a coverage change only through a formal fresh appointment letter.
Can a concurrent audit finding lead to disciplinary or regulatory action against branch staff?
Concurrent audit reports go to bank management, which decides on any disciplinary, corrective, or process action based on the findings — the concurrent auditor's role is to identify and report irregularities accurately, not to determine consequences for staff. In cases involving suspected fraud or serious regulatory breaches, the bank may separately escalate to its vigilance or fraud investigation function, or to RBI, depending on materiality and the bank's own policy.
In practice: We keep our reporting strictly factual and evidence-based, avoiding characterisations that go beyond what the audit evidence supports — the bank's management and, where applicable, its vigilance function are responsible for any subsequent action.
How does concurrent audit interact with a bank's statutory tax audit obligations?
Concurrent audit does not itself address the bank's tax audit obligations under Section 44AB of the Income-tax Act, which are typically handled at the entity level by the bank's appointed tax auditors, drawing on consolidated financial data rather than branch-level concurrent audit reports. However, the reconciliation and documentation discipline that concurrent audit reinforces at branch level — accurate TDS deduction records, clean suspense accounts — supports the overall quality of data that eventually feeds the bank's consolidated tax audit.
In practice: We are clear with clients that concurrent audit is not a substitute for, or a component of, the bank's Section 44AB tax audit — the two are governed by entirely different statutes and reporting requirements.
Where this sits in the wider engagement
Bank Concurrent & Statutory Audit rarely arrives on its own. The statutory basis and the current requirements are set out on the Bank Concurrent & Statutory Audit service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Bank Concurrent & Statutory Audit we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.